Thanks. The /CS pullup is listed as optional and not needed for the W25Q128. I did check and it shows being pulled to VCC so it isn't floating. I will put a resistor on it to see though. Run pin is left floating in every implementation I've seen, including the Pico. At this point though, I'll give it a try.
Actually, a pull-up would be needed for the W25Q128, which can be read in its datasheet, so there's nothing special with this flash chip that would not require it. (If the MCU didn't have an internal pull-up, it would definitely be required.)
But looking back at the RP2040 datasheet, it looks like the reset state of both the RUN and QSPI_SS pins is with a pull-up enabled, so I guess that should work without external pull-ups, which explains why the Pico doesn't have them. The Pico's schematic shows a "DNI" pull-up for the /CS signal, and in the Pico board I physically have, there's a footprint but it's indeed not populated.
So, these external pull-ups shouldn't be strictly necessary, unless there's an errata regarding this with the RP2040, I haven't checked. I have put both pull-ups in my own designs. If nothing else, I'm rarely comfortable with just internal weak pull-ups, which are often > 50k. More sensitive to EMI than a well defined, 10k pull-up.
I suppose your boards have not been hand-assembled then, and that soldering is not likely to be an issue?